Skip to content

fix(eip712): signature-request display fixes + core address Key decoding#1366

Merged
Comp0te merged 13 commits into
developfrom
eip712-display-feedback
Jun 24, 2026
Merged

fix(eip712): signature-request display fixes + core address Key decoding#1366
Comp0te merged 13 commits into
developfrom
eip712-display-feedback

Conversation

@ost-ptk

@ost-ptk ost-ptk commented Jun 24, 2026

Copy link
Copy Markdown
Member

What

EIP-712 signature-request display fixes (WALLET-1251) from QA re-test, plus the casper-wallet-core bump that carries the address Key-decoding and date logic.

Changes

  • formatPrimaryTypeLabel splits the camelCase primaryType so the message header reads "TRANSFER WITH AUTHORIZATION" instead of an unreadable run-on word.
  • Hash values (nonce, raw package hash) render blue with a copy icon.
  • Bump casper-wallet-core to pick up: EIP-712 address values decoded as Casper Keys (a contract package address is no longer shown as a "Public key"), timestamp dates + sentinels ("Always" / "No expiry"), and CAIP-2 chain names.

Notes

Depends on

@ost-ptk ost-ptk requested a review from Comp0te June 24, 2026 08:08
Base automatically changed from eip712-naming-alignment to develop June 24, 2026 14:57
.replace(/\s+/g, ' ')
.trim()
.split(' ')
.map(word => capitalizeString(word))

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

formatPrimaryTypeLabel throws a TypeError on separator-only input.

After .replace(/[_-]+/g, ' ')…trim(), an input made up only of separators/whitespace reduces to '', and ''.split(' ') yields [''] — so capitalizeString('') runs ''[0].toUpperCase()undefined.toUpperCase() and throws. The early if (!value) guard only catches empty/undefined, not '_' / '__' / '-' / ' '.

"_"   => THROWS: Cannot read properties of undefined (reading 'toUpperCase')
"__"  => THROWS: ...
"   " => THROWS: ...

This is reachable from untrusted input: primaryType is a dapp-supplied string (SignTypedDataParams.primaryType: string) passed straight to formatPrimaryTypeLabel(signatureRequest.primaryType) in sign-eip712-content.tsx with no wallet-side validation. _ is a valid EIP-712 / Solidity type identifier, so a dapp can send primaryType: "_" and crash the signature-request render.

Suggested fix — drop empty segments after the split:

    .split(' ')
    .filter(Boolean)
    .map(word => capitalizeString(word))
    .join(' ');

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — fixed in 8580c2d. Added .filter(Boolean) after the split to drop empty segments, plus a regression test covering "_", "__", "-" and " " (all now return "" instead of throwing).

Separator-only primaryType values (e.g. "_", "__", "-") reduced to an
empty string after normalization, producing an empty segment that crashed
capitalizeString with a TypeError. Since primaryType is dapp-supplied and
unvalidated, this could crash the signature-request render. Drop empty
segments after splitting.
@ost-ptk ost-ptk requested a review from Comp0te June 24, 2026 15:26
…dback

# Conflicts:
#	package-lock.json
#	package.json
@Comp0te Comp0te merged commit 3213efe into develop Jun 24, 2026
6 checks passed
@Comp0te Comp0te deleted the eip712-display-feedback branch June 24, 2026 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants